StabisoDocs

API reference

Roles

Roles in plain words: the ready-made roles and the organization's own, each a person's rights, the areas of the app it opens and which sales records its people see; who has which, what a person can open and do, and the rights nobody used for 90 days.

Operation Summary Scope Idempotency-Key
GET /v1/roles List the roles admin
POST /v1/roles Make an own role admin
GET /v1/roles/areas List the areas of the app read
GET /v1/roles/me See what I can open and do read
GET /v1/roles/people List who has which role admin
PUT /v1/roles/people/{user_id} Give a person a role admin
GET /v1/roles/people/{user_id}/preview See what a person can open and do admin
GET /v1/roles/suggestions List unused rights admin
POST /v1/roles/suggestions/{suggestion_id}/apply Take away an unused right admin
PATCH /v1/roles/{role_id} Change an own role admin
DELETE /v1/roles/{role_id} Remove an own role admin

GET /v1/roles

List the roles

The ready-made roles (accounts payable clerk, sales rep, controller, ...) and the organization's own, each with its rights, the areas it opens, which sales records its people see, what it allows and does not allow in plain words, and how many people have it.
Required scope admin (admin implies every scope)
Operation id list_roles_v1_roles_get

Example request

curl "$ERP_URL/v1/roles" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK array of RoleOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

[
  {
    "id": "string",
    "kind": "own",
    "title": "string",
    "summary": "string",
    "based_on": "string",
    "scopes": [
      "string"
    ],
    "areas": [
      "string"
    ],
    "visibility": "all",
    "can": [
      "string"
    ],
    "cannot": [
      "string"
    ],
    "people": 1
  }
]

POST /v1/roles

Make an own role

A role of the organization's own, from a ready-made one (based_on, default viewer): what is not sent is taken from it. An administrator's role opens every area. 409 role_title_taken; 422 role_template, unknown_scopes, unknown_area. Audited as role.create.
Required scope admin (admin implies every scope)
Idempotency-Key not used
Operation id create_role_v1_roles_post

Request body

application/json (required): RoleInput

Field Type Required Description
title string yes The role's name. (min length 1; max length 80)
based_on string The ready-made role it starts from (GET /v1/roles); what is not sent below is taken from it. Default viewer. (default "viewer")
summary string or null What it is for. (max length 400)
scopes array of string or null Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null The areas of the app it opens (ledger, sales, purchasing, bank, assets, close, reports, stock, service: GET /v1/roles/areas); null: every area. Omit to take them from based_on.
visibility "all" | "own" | "team" or null Which sales records its people see: all, team (their sales teams') or own (theirs).

Example request

curl -X POST "$ERP_URL/v1/roles" \
  -H "Authorization: Bearer $ERP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "based_on": "ap_clerk",
  "scopes": [
    "read",
    "draft",
    "post",
    "approve"
  ],
  "title": "Payables lead"
}'

Responses

Status Meaning Body
201 Created RoleOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
409 The request conflicts with the data: an Idempotency-Key reused with a different request, a closed period, or an integrity rule of the database (conflict, integrity_violation). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "id": "string",
  "kind": "own",
  "title": "string",
  "summary": "string",
  "based_on": "string",
  "scopes": [
    "string"
  ],
  "areas": [
    "string"
  ],
  "visibility": "all",
  "can": [
    "string"
  ],
  "cannot": [
    "string"
  ],
  "people": 1
}

GET /v1/roles/areas

List the areas of the app

The areas a role opens, as the app's sidebar groups them: the general ledger, sales, purchasing, the bank, assets and tax, the close, reports, stock and service. A person whose role opens only some of them gets 403 area_closed (with area) for an operation of another; settings, approvals, search and their own notifications are everyone's, and customers, vendors, products, cost centres and exchange rates everyone may read.
Required scope read (admin implies every scope)
Operation id list_areas_v1_roles_areas_get

Example request

curl "$ERP_URL/v1/roles/areas" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK array of AreaOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope

Example response (shape)

[
  {
    "key": "string",
    "title": "string",
    "summary": "string"
  }
]

GET /v1/roles/me

See what I can open and do

Your own areas, rights and what they allow, in plain words; for a person signed in to the app (409 preview_web_only for an API key).
Required scope read (admin implies every scope)
Operation id mine_v1_roles_me_get

Example request

curl "$ERP_URL/v1/roles/me" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK PreviewOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "string",
  "email": "string",
  "role_title": "string",
  "scopes": [
    "string"
  ],
  "areas": [
    {
      "key": "string",
      "title": "string",
      "summary": "string"
    }
  ],
  "closed_areas": [
    {
      "key": "string",
      "title": "string",
      "summary": "string"
    }
  ],
  "visibility": "all",
  "can": [
    "string"
  ],
  "cannot": [
    "string"
  ],
  "access_until": "2026-09-21T09:30:00Z",
  "approver": true
}

GET /v1/roles/people

List who has which role

Every person of the organization with their role, rights, the areas they open, which sales records they see, whether that still is their role's, and the last day they used the app.
Required scope admin (admin implies every scope)
Operation id list_people_v1_roles_people_get

Example request

curl "$ERP_URL/v1/roles/people" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK array of PersonAccessOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

[
  {
    "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "string",
    "email": "string",
    "status": "string",
    "role": "string",
    "role_title": "string",
    "scopes": [
      "string"
    ],
    "areas": [
      "string"
    ],
    "visibility": "all",
    "differs": true,
    "last_used": "2026-09-21"
  }
]

PUT /v1/roles/people/{user_id}

Give a person a role

Sets the person's rights, which sales records they see and the areas they open, from their next request on. A role that lets them approve when their rights did not needs the approver declaration (422 approver_declaration_missing); nobody takes away their own administration (409 own_admin_scope). Only a person may give roles. Audited as role.give with user.update.
Required scope admin (admin implies every scope)
Idempotency-Key not used
Operation id give_role_v1_roles_people__user_id__put

Parameters

In Name Type Required Description
path user_id string (uuid) yes Id of the person (GET /v1/roles/people).

Request body

application/json (required): RoleAssignment

Field Type Required Description
role string yes A ready-made role's key or an own role's id (GET /v1/roles).
approver ApproverDeclaration or null Who the person is, when the role lets them approve and their rights did not (422 approver_declaration_missing otherwise).

Example request

curl -X PUT "$ERP_URL/v1/roles/people/{user_id}" \
  -H "Authorization: Bearer $ERP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "role": "ap_clerk"
}'

Responses

Status Meaning Body
200 OK PersonAccessOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
409 The request conflicts with the data: an Idempotency-Key reused with a different request, a closed period, or an integrity rule of the database (conflict, integrity_violation). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "string",
  "email": "string",
  "status": "string",
  "role": "string",
  "role_title": "string",
  "scopes": [
    "string"
  ],
  "areas": [
    "string"
  ],
  "visibility": "all",
  "differs": true,
  "last_used": "2026-09-21"
}

GET /v1/roles/people/{user_id}/preview

See what a person can open and do

What the person sees and may do, in plain words: the areas they open and do not, what they can and cannot do, which sales records they see and when their access ends.
Required scope admin (admin implies every scope)
Operation id preview_v1_roles_people__user_id__preview_get

Parameters

In Name Type Required Description
path user_id string (uuid) yes Id of the person (GET /v1/roles/people).

Example request

curl "$ERP_URL/v1/roles/people/{user_id}/preview" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK PreviewOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "name": "string",
  "email": "string",
  "role_title": "string",
  "scopes": [
    "string"
  ],
  "areas": [
    {
      "key": "string",
      "title": "string",
      "summary": "string"
    }
  ],
  "closed_areas": [
    {
      "key": "string",
      "title": "string",
      "summary": "string"
    }
  ],
  "visibility": "all",
  "can": [
    "string"
  ],
  "cannot": [
    "string"
  ],
  "access_until": "2026-09-21T09:30:00Z",
  "approver": true
}

GET /v1/roles/suggestions

List unused rights

Rights and areas a person has not used for 90 days, and people who used nothing and did not sign in: each an offer to take it away. Use is counted from counting_since; a person whose rights changed in the 90 days is left out until they have been watched as long.
Required scope admin (admin implies every scope)
Operation id list_suggestions_v1_roles_suggestions_get

Example request

curl "$ERP_URL/v1/roles/suggestions" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK SuggestionsOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "counting_since": "2026-09-21",
  "days": 1,
  "suggestions": [
    {
      "id": "string",
      "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "string",
      "email": "string",
      "kind": "close_area",
      "right": "string",
      "areas": [
        null
      ],
      "reason": "string"
    }
  ]
}

POST /v1/roles/suggestions/{suggestion_id}/apply

Take away an unused right

Applies a suggestion that still stands (404 suggestion_gone otherwise): the right removed, the area closed, the areas narrowed or the access ended, as Settings would, with the same audit trail.
Required scope admin (admin implies every scope)
Idempotency-Key not used
Operation id apply_suggestion_v1_roles_suggestions__suggestion_id__apply_post

Parameters

In Name Type Required Description
path suggestion_id string yes The suggestion's id (GET /v1/roles/suggestions).

Example request

curl -X POST "$ERP_URL/v1/roles/suggestions/{suggestion_id}/apply" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK Applied
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
409 The request conflicts with the data: an Idempotency-Key reused with a different request, a closed period, or an integrity rule of the database (conflict, integrity_violation). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "user_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "done": "string"
}

PATCH /v1/roles/{role_id}

Change an own role

Only the fields sent change; areas null opens every area. The people who have the role keep what they were given: the list of people shows them as differing until the role is given to them again. 409 role_ready_made for a ready-made role. Audited as role.update.
Required scope admin (admin implies every scope)
Idempotency-Key not used
Operation id update_role_v1_roles__role_id__patch

Parameters

In Name Type Required Description
path role_id string yes An own role's id (GET /v1/roles); a ready-made role's key is refused.

Request body

application/json (required): RoleUpdate

Field Type Required Description
title string or null The role's new name. (min length 1; max length 80)
summary string or null What the role is for, in a sentence. (max length 400)
scopes array of string or null Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null The areas of the app it opens (ledger, sales, purchasing, bank, assets, close, reports, stock, service: GET /v1/roles/areas); null: every area. Omit to keep them; send null for every area.
visibility "all" | "own" | "team" or null Which sales records its people see: all, team (their sales teams') or own (theirs).

Example request

curl -X PATCH "$ERP_URL/v1/roles/{role_id}" \
  -H "Authorization: Bearer $ERP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "areas": [
    "purchasing",
    "bank"
  ]
}'

Responses

Status Meaning Body
200 OK RoleOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
409 The request conflicts with the data: an Idempotency-Key reused with a different request, a closed period, or an integrity rule of the database (conflict, integrity_violation). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "id": "string",
  "kind": "own",
  "title": "string",
  "summary": "string",
  "based_on": "string",
  "scopes": [
    "string"
  ],
  "areas": [
    "string"
  ],
  "visibility": "all",
  "can": [
    "string"
  ],
  "cannot": [
    "string"
  ],
  "people": 1
}

DELETE /v1/roles/{role_id}

Remove an own role

Only while nobody has it (409 role_in_use, with people); 409 role_ready_made for a ready-made role. Audited as role.delete.
Required scope admin (admin implies every scope)
Idempotency-Key not used
Operation id delete_role_v1_roles__role_id__delete

Parameters

In Name Type Required Description
path role_id string yes An own role's id (GET /v1/roles); a ready-made role's key is refused.

Example request

curl -X DELETE "$ERP_URL/v1/roles/{role_id}" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
204 No content
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
409 The request conflicts with the data: an Idempotency-Key reused with a different request, a closed period, or an integrity rule of the database (conflict, integrity_violation). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Schemas

Applied

Field Type Required Description
user_id string (uuid) yes Id of the person whose access changed.
done string yes What changed, in plain words.

AreaOut

Field Type Required Description
key string yes The area's key, as roles and Me.areas name it.
title string yes Its name, as the app's sidebar shows it.
summary string yes What lies in it, in plain words.

PersonAccessOut

Field Type Required Description
user_id string (uuid) yes Id of the person.
name string or null yes Their name; null when they gave none.
email string yes The address they sign in with.
status string yes invited, active or disabled.
role string or null yes The role given with PUT /v1/roles/people/{user_id}; null for a person whose rights were set otherwise (on Settings, Users).
role_title string or null The role's name; null: no role.
scopes array of string yes Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null yes The areas the person opens; null: every area.
visibility "all" | "own" | "team" yes Which sales records its people see: all, team (their sales teams') or own (theirs).
differs boolean yes True when the person's rights or areas are no longer their role's (their rights were changed since, or the own role was).
last_used string (date) or null yes The last day the person (or a key acting for them) used the app; null: not since use is counted.

PreviewOut

Field Type Required Description
user_id string (uuid) yes Id of the person.
name string or null yes Their name; null when they gave none.
email string yes The address they sign in with.
role_title string or null yes Their role's name; null: no role.
scopes array of string yes Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of AreaOut yes The areas the person opens.
closed_areas array of AreaOut yes The areas they do not open.
visibility "all" | "own" | "team" yes Which sales records its people see: all, team (their sales teams') or own (theirs).
can array of string yes What they can do, in English sentences.
cannot array of string yes What they cannot do, in English sentences.
access_until string (date-time) or null yes When the person's access ends.
approver boolean yes True when they may approve what others prepare.

RoleAssignment

Field Type Required Description
role string yes A ready-made role's key or an own role's id (GET /v1/roles).
approver ApproverDeclaration or null Who the person is, when the role lets them approve and their rights did not (422 approver_declaration_missing otherwise).

RoleInput

Field Type Required Description
title string yes The role's name. (min length 1; max length 80)
based_on string The ready-made role it starts from (GET /v1/roles); what is not sent below is taken from it. Default viewer. (default "viewer")
summary string or null What it is for. (max length 400)
scopes array of string or null Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null The areas of the app it opens (ledger, sales, purchasing, bank, assets, close, reports, stock, service: GET /v1/roles/areas); null: every area. Omit to take them from based_on.
visibility "all" | "own" | "team" or null Which sales records its people see: all, team (their sales teams') or own (theirs).

RoleOut

Field Type Required Description
id string yes A ready-made role's key (ap_clerk, sales_rep, ...) or an own role's id.
kind "own" | "ready_made" yes ready_made (the product's, unchangeable) or own (the organization's).
title string yes The role's name.
summary string or null What the role is for.
based_on string or null An own role: the ready-made role it was made from.
scopes array of string yes Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null yes The areas of the app it opens (ledger, sales, purchasing, bank, assets, close, reports, stock, service: GET /v1/roles/areas); null: every area.
visibility "all" | "own" | "team" yes Which sales records its people see: all, team (their sales teams') or own (theirs).
can array of string yes What someone with the role can do, in plain words.
cannot array of string yes What they cannot do, in plain words.
people integer yes How many people of the organization have it.

RoleUpdate

Field Type Required Description
title string or null The role's new name. (min length 1; max length 80)
summary string or null What the role is for, in a sentence. (max length 400)
scopes array of string or null Its rights: read always, and any of draft, post, approve, audit, admin (admin holds every right and opens every area).
areas array of string or null The areas of the app it opens (ledger, sales, purchasing, bank, assets, close, reports, stock, service: GET /v1/roles/areas); null: every area. Omit to keep them; send null for every area.
visibility "all" | "own" | "team" or null Which sales records its people see: all, team (their sales teams') or own (theirs).

SuggestionOut

Field Type Required Description
id string yes Pass it to POST /v1/roles/suggestions/{id}/apply.
user_id string (uuid) yes Id of the person.
name string or null yes Their name; null when they gave none.
email string yes The address they sign in with.
kind "close_area" | "end_access" | "narrow_areas" | "remove_right" yes remove_right (a right unused), close_area (an area unused), narrow_areas (a person who opens every area used only some) or end_access (nothing used and no sign-in).
right string or null remove_right: the right.
areas array of string or null close_area: the area; narrow_areas: the areas kept.
reason string yes Why, in plain words.

SuggestionsOut

Field Type Required Description
counting_since string (date) or null yes The first day use was counted in this organization; suggestions come once a right was held and watched for the 90 days they look back.
days integer yes How many days without use make a suggestion (90).
suggestions array of SuggestionOut yes What to take away, person by person.
Stabiso, the Enterprise System of Record · generated from the code and its guides · release 20b7dd5b0c4d